5

I'm sorry for my bad English. I'm a beginner in Reverse Engineering. I have a problem like this. I was given two files, one is driver's .inf file and the other is driver's .sys file. My mission is to debug this driver and understand its functionality(driver doesn't have physical device). I use 2 machines, one is the host machine which is actually my real computer and a XP virtual machine(VMware). I also use VirtualKD and Windbg. I want to set breakpoint at its DriverEntry.

When I installed driver, I noticed that it ran automatically right after being installed. So I can't set breakpoint at DriverEntry. I restarted virtual machine and set breakpoint in Windbg with all the following commands:
bu Driver!DriverEntry (Driver is driver's ClassName, I saw it in .inf file)
bu Drv!DriverEntry (Drv is its service name when installed)
bu drv!DriverEntry (drv is sys file name, drv.sys)
But Windbg didn't catch any breakpoints. I saw Windbg printed out some infos, I don't know whether it made breakpoints could not catch:

* * A driver is mapping physical memory 0064F000->006D0FFF * that it does not own. This can cause internal CPU corruption. * A checked build will stop in the kernel debugger * so this problem can be fully debugged. *

ERROR: DavReadRegistryValues/RegQueryValueExW(4). WStatus = 5 ERROR: DavReadRegistryValues/RegQueryValueExW(5). WStatus = 5 ERROR: DavReadRegistryValues/RegQueryValueExW(6). WStatus = 5 CodeSet_Init: no ICU watchdog!WdUpdateRecoveryState: Recovery enabled.


My second thought was I rolled back my virtual machine and set breakpoints before installing driver. But Windbg said that it could not resolve those breakpoints. And of course it cannot hit any of them.

I really don't know how to set this driver's entry. Please help me. Thank you.

P/S: probably this driver can communicate with other app through pipe. How can I debug it without infecting its communication?

Improve this question

3 Answers 3

Reset to default
-1

You can follow the steps in the comments on this site:

http://windbg.info/doc/1-common-cmds.html

This roughly equals to what Igor suggested.

Improve this answer
1
  • I see that they wrote "click Arguments and enter the name of the driver in question". In my case, is that ClassName, sys file name or service name?
    – user1680791
    Commented Apr 10, 2015 at 14:26
6

you can try breaking on driver load instead on just the entry:

sxe ld drv.sys

This will stop windbg when the image gets loaded, so you'll be able to set breakpoints using raw addresses if all else fails.

Improve this answer
2
  • You mean I need to set breakpoint at its actual address in memory, right? But how can I know its raw addresses?
    – user1680791
    Commented Apr 10, 2015 at 13:38
  • Igor, could you please verify whether the .sys is really necessary or even allowed? For the life of me I was unable to recreate it with the .sys extension. Works fine without.
    – 0xC0000022L ♦
    Commented May 6, 2022 at 13:30
3

patch the Address of Entry Point with a (0xcc aka int 3) and load the driver AddrOfEntryPoint normally points to either DriverEntry or GsDriverEntry

when broken you need to replace 0xcc by original byte and reset eip back by a byte

use eb <address> originalbyte enter 
r eip = <addresss>

here is the entry point of beep.sys which points to Beep!driverEntry

lkd> lm m beep
start    end        module name
f7b0e000 f7b0f080   Beep       (pdb symbols)          f:\symbols\beep.pdb\65DC45B439164E4C9DEFF20E161DC74C1\beep.pdb
lkd> ? by(beep+3c) 
Evaluate expression: 208 = 000000d0
lkd> ? dwo(beep+dwo(beep+3c)+28)
Evaluate expression: 1644 = 0000066c
lkd> .printf "%y\n" , beep+66c
Beep!DriverEntry (f7b0e66c)
lkd>
Improve this answer
3
  • After changing the byte of Entry point, should I have to restart the virtual machine? As I said, it ran automatically whenever the virtual machine reboot.
    – user1680791
    Commented Apr 10, 2015 at 14:30
  • there are various kinds of start for a driver right from boot start to demand start i cant say what your driver start mode is you have to ascertain it and do appropriate action to reload the driver if it was demand start net stop blah net start blah should unload and reload the dll if it was boot start you can see the current control set registry entry and modify it to dmand start or use sc.exe to query and modify the config you can reboot from windbg itself with ,reboot command thats a vast area have fun finding out if you patched and you realoaded the driver you will break in debugger
    – blabb
    Commented Apr 10, 2015 at 18:23
  • @blabb how do i patch the Address of Entry Point ???
    – AminM
    Commented Jan 2, 2016 at 7:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.